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A general proof of the security against eavesdropping of 
a previously introduced protocol for two-party quantuin key 
distribution based on entanglement swapping [Phys. Rev. A 
61, 052312 (2000)] is provided. In addition, the protocol is 
extended to permit multiparty quantum key distribution and 
secret sharing of classical information. 

PACS numbers: 03.67.Dd, 03.67.Hk, 03.65.Bz 



I. INTRODUCTION 

Entanglement swapping (ES), that is, entangling a set 
of particles S by appropriately projecting other parti- 
cles previously entangled with particles of S [l]-pl, has 
found a number of applications in quantum information: 
constructing a quantum telephone exchange, speeding up 
the distribution of entanglement, correcting errors in Bell 
states, and preparing entangled states of a higher num- 
ber of particles ^^- Recently, ES has also been used 
to solve the problem of cryptographic key distribution 
between two parties in an essentially new way Q. In 
this paper, the scheme of Ref. |^ is extended to per- 
mit the distribution of the same key to several users 
(multiparty key distribution), and to permit the distri- 
bution of the same key to several users in such a way 
that they must cooperate to obtain the key (secret shar- 
ing of classical informati on). The structure of the paper 
is the following: In Sec. II A the protocol for quantum 
key distribution between two parties based on ES is re- 
viewed. A general proof of its security is provided in 



Sec. II B, Multiparty key distribution is introduced, and 



a new protocol using Greenberger-Horne-Zeilingcr (GHZ) 
states ||7| is presented in Sec. Ill A. In Sec. IIIB a differ- 



ent approach, based on ES and which is a generalization 
the two-party protocol, is introduced. Secret sharing is 
treated in Sec. |^. Two previous protocols for secret 
sharing using, r espec tivel y, GH Z and Bell st ates are re- 
viewed in Sees. |IV A| and IV B. In Sec. IV C, it is shown 
how the scheme of three-party key distribution based on 
ES described in Sec. IIIB, also permits secret shariiig. 



The case of more than three users is treated in Sec. 



Sec. VI is dedicated to demonstrate the security of ES- 



based protocols against eavesdropping. Finally, the main 
advantages of these protocols are summarized in Sec. VII. 



II. QUANTUM KEY DISTRIBUTION BETWEEN 
TWO PARTIES 



A. The protocol based on entanglement swapping 

The key distribution problem of cryptography is the 
following: Alice wishes to convey a sequence of random 
classical bits (a "key") to Bob, while preventing that Eve 
acquires information without being detected. This prob- 
lem, which has no solution by classical means, can be 
solved using quantum mechanics [|j . Indeed, subsequent 
developments have shown that quantum mechanics pro- 
vides different tools to solve the problem. Some are based 
on the impossibility of cloning unknown nonorthogonal 
quantum states M M, some also use entanglement be- 
tween two particles llfl,0] , some combine quantum tech- 
niques with classical private amplification and compres- 
sion techniques [ p2[ , and some are based on splitting the 
information in several qubits to which Eve has only a 
sequential access [n3-15|. In Ref. [p|, a new method for 
key distribution based on ES was introduced. Let us start 
by briefly reviewing how this ES-based protocol works. 
Consider the orthonormal basis of Bell states given by: 
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where 



being cr^ the corresponding Pauli spin matrix. For con- 
venience, we shall divide the protocol in three parts: 

(I) Preparation. Initially, Alice has four qubits: qubits 
1 and 2, prepared in one public Bell state of the basis 
(|l|)"®' ^'^'^ qubits 3 and 5, prepared in another Bell 
public state of the same basis. Bob, in a distant place, 
has two qubits, 4 and 6, prepared in a public Bell state 
of the same basis. For example, the initial state of the 
six qubits can be 
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Next, Alice sends qubit 2 out to Bob through an insecure 
quantum channel (i.e., Eve can manipulate qubit 2). 

(II) Generation of two bits of the key. Alice performs 
a complete Bell-state measurement on qubits 1 and 3 
(henceforth referred to as Alice's secret measurement). 
The result, AS (a random number: "00" if the result is 
|00), "01" if it is |01), "10" if it is |10), or "11" if it is 
1 11)), defines two bits of the key. Then, the state is 



I* 



// 



\AS),,®\AS'),,^m, 



(8) 



where |^iS") is a Bell state which is in one-to-one corre- 
spondence with \AS). 

(Ill) How Bob obtains the two bits of the key. Bob per- 
forms a complete Bell-state measurement on qubits 2 and 
4 (henceforth referred to as Bob's secret measurement), 
and keeps the result, BS, secret. After that, the state is 
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where \AP) is a Bell state which can be determined from 
the pair AS, BS. Then, Bob sends qubit 6 out to Alice 
(i.e.. Eve can manipulate qubit 6). Finally, Alice per- 
forms a complete Bell-state measurement on qubits 5 and 
6 (henceforth referred to as Alice's public measurement), 
and publicly announces the result, AP, through a clas- 
sical channel (which is assumed to be public but which 
cannot be altered) |]16|. Due to the successive ES be- 
tween the pairs of qubits, for each of the four possible 
values of AP, there is a different one-to-one correspon- 
dence between the results of Alice's and Bob's secret mea- 
surements. These correspondences are compiled in Table 
I. Therefore, once Bob knows the AP, he can infer AS. 
The process must be sequentially repeated until the key 
is large enough. 



B. Security of the protocol based on ES 

In Ref. [^, the security against eavesdropping of the 
protocol for two-party key distribution based on ES was 
showed for a particular eavesdropping attack. Here I will 
provide a general (i.e., attack- independent) proof. 

The result AS defines two bits of the key. However, 
AS is random and Eve cannot infiuence it by manipu- 
lating any of the transmitted qubits. To obtain AS, Eve 
needs the same two ingredients as Bob: BS and AP. In 
addition, to avoid being detected. Eve needs to obtain 
BS without changing AP. However, since Eve has only 
access to two of the six qubits, we shall see that any pro- 
cedure that allows Eve to obtain BS, changes AP in an 
unpredictable way. Let us examine the strategies that 
Eve can follow and their consequences. 

In step (I) of the protocol, the only qubit accessible 
to Eve is qubit 2. If Eve's aim is to obtain BS (as a 
previous step to obtain AS), the only useful strategy is 
one whose result is equivalent to capturing qubit 2 and 
substituting it by an ancillary qubit 8 (which will be sent 



out to Bob) , which was previously prepared in a Bell state 
(for instance 1 00)^5) with another ancillary qubit 7 (which 
will be retained by Eve) [0. After this manoeuvre the 
state of the qubits is 
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where Alice has qubits 1, 3, and 5; Bob has qubits 4, 
6, and 8; and Eve has qubits 2 and 7. This situation is 
illustrated in Fig. 1 (al). The corresponding situation 
in the alternative scenario in which Eve is not present is 
illustrated in Fig. 1 (bl). 

In step (II) , Alice performs her secret measurement on 
qubits 1 and 3, and Bob performs his secret measurement 
on qubits 4 and 8 (which substitutes qubit 2) . After these 
measurements the state of the qubits is 
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where \AS) is the Bell state which defines two bits of the 
key, \AS') is a Bell state in one-to-one correspondence 
with \AS), \BS) is the Bell state which gives Bob's se- 
cret result BS, and \BS') is a Bell state in one-to-one 
correspondence with \BS). This situation is illustrated 
in Fig. 1 (a2). The corresponding situation in the alter- 
native scenario in which Eve is not present is illustrated 
in Fig. 1 (b2). 

In the step (III), Bob sends qubit out 6 to Alice. This 
allows Eve to capture it and obtain BS by performing a 
Bell-state measurement on qubits 6 and 7 (the result BS' 
of this measurement is in one-to-one correspondence with 
BS). This is (modulo equivalencies) the only strategy 
that allows Eve to obtain BS. Now, to obtain AS, she 
still needs to know AP (which must be in one-to-one 
correspondence with the pair AS, BS). However, Eve's 
intervention has changed the state of the qubits (compare 
I*//) with 1*;^)). 

Before Alice's public measurement, Eve has access to 
qubit 2 (which is in a Bell state, unknown to Eve, with 
Eve's qubit 5), and to qubits 6 and 7. If Eve manages 
to give Alice a qubit in the Bell state \AP) with qubit 2, 
then her intervention won't be detected. Eve can prepare 
a qubit in any desired Bell state with qubit 2; the problem 
is that she does not know which is the "correct" Bell 
state. Indeed, she cannot know which is the right one 
since this would require Eve to know lAS')^^^ (and Eve 
has no access to qubits 1 and 3), or \AS')2^ (and Eve only 
has access to qubit 2, and since the partial trace of all 
the Bell states is the identity matrix, any measurement 
on one qubit cannot reveal anything about the state of 
both qubits). 

Alternatively, if Eve gives to Alice qubit 6 (or 7) , then 
the result of Alice's public measurement will allow Eve 
to obtain AS' (and therefore AS). However, this result is 
not in one-to-one correspondence with the pair AS, BS 
anymore. Therefore, the result obtained by Alice will be 
the "wrong" one in | of the runs, and thus Eve's inter- 
vention can be detected when Alice and Bob compare 
subsets of their keys. 



Summing up, no strategy allows Eve to extract infor- 
mation without being detected, because the only strategy 
that Eve can use to obtain information will change the 
expected result for AP in | of the cases. In addition, this 
proves that one of the interesting features of the proto- 
col based on ES — namely, that it improves the efficiency 
of the detection of eavesdropping compared with other 
protocols M — is independent of the attack. 



III. MULTIPARTY KEY DISTRIBUTION 
A. Multiparty key distribution using two GHZ states 

Consider the following problem: Alice wishes to con- 
vey the same key to N users (Bob, Carol,. . . , Nathan), 
while preventing Eve from acquiring information with- 
out being detected. This problem, called multiparty key 
distribution, is a special case of networked cryptographic 
conferencing pq , p^ . 

Here I introduce a protocol for using GHZ states for 
multiparty quantum key distribution that, as far as I 
know, has not been presented anywhere before. It can 
be considered as a generalization to many parties of the 
two-party protocol of Ref. [EOJ . 

Let us focus our attention in the case A^ = 3 (the 
cases with N > 3 are straightforward extensions of this 
case). Alice wishes to distribute the same key to Bob 
and Carol. For that purpose, she randomly prepares one 
of the following two three-qubit GHZ states: 
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being a^ the corresponding Pauli spin matrix. Then Al- 
ice sends one of the three qubits out to Bob, another to 
Carol, and retains the third one. Bob and Carol perform 
a measurement of either cr^ or a^ on their own qubit. 
When Alice has prepared the state \ipz) {\tpx)), and both 
Bob and Carol have measured a^ (cx) — i.e., in j of the 
cases — , all of them obtain the same result. In that case, 
they can use this result to define one bit of the key. The 
other cases are not useful for establishing a common key 
and are rejected. Alternatively, to reduce the wastage of 
qubits due to the noncoincidence of the measurements, 
Alice can tell Bob and Carol which is the "right" mea- 
surement (once all three qubits are safe from Eve's in- 
tervention). The security of this scheme against eaves- 
dropping is guaranteed by the impossibility of cloning an 



unknown state chosen between {i/jz) and li^x), specially 
when Eve only has access to two of the three qubits. 



B. Multiparty key distribution based on 
entanglement swapping 

A different multiparty key distribution protocol can be 
obtained using ES. Indeed, what follows is just one of the 
possible generalizations to three parties of the protocol 
for key distribution between two parties based on ES of 
Ref. @. 

Consider the orthonormal basis of GHZ states given 
by: 
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The protocol can be summarized in four steps, which are 
illustrated in Fig. 2: 

(i) Initially, Alice has qubits 1 and 2, prepared in one 
public Bell state of the basis (ll|)-(0), and qubits 3, A, and 
B (qubits described by numbers stay with the same user 
during all the protocol, and qubits described by letters 
are transmitted between users du ring the protocol) pre- 
pared in a GHZ state of the basis ([l6|)-(p3|). Bob (Carol), 
in a distant place, has two qubits, 5 and D (4 and C), 
prepared in a public Bell state. For instance, the initial 
state of the nine qubits can be 
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where subindexes 3, A, etc., mean qubits 3, A, etc. 

(ii) Then, AUce sends qubit A {B) out to Bob (Carol) 
through an insecure quantum channel. Next, Alice per- 
forms a secret Bell-state measurement on qubits 2 and 3, 
Bob performs a secret Bell-state measurement on qubits 
5 and v4, and Carol performs a secret Bell-state measure- 
ment on qubits 4 and B. 

(iii) After these three secret measurements, the state 
of qubits 1, C, and D becomes a GHZ state of the basis 
([l6|)-(P3|), due to multiparticle ES g]. The final state is 

1^...) = \AP),cD ® l^^>23 ® \BS)^A ® |C5)4s ■ (25) 

(iv) Then, Bob (Carol) sends qubit D (C) out to Al- 
ice, who performs a complete GHZ-state measurement 
on qubits 1, C, and D [i.e., a measurement which un- 
ambiguously discriminates between states ([l6|)-(p3|)], and 
publicly announces the result through a classical channel. 

Out of the 512 possible combinations of results (for Al- 
ice's public measurement, and Alice's, Bob's, and Carol's 
secret measurements), there are only 64 which have a 
nonzero probability to occur. If the initial state is (24), 
these 64 combinations are represented in Tabic II. All of 
them have the same probability to occur (^). 

The secret key that Alice, Bob, and Carol will share is 
defined as the first bit of Alice's secret measurement. As 
a close examination of Table II reveals. Bob (or Carol) 
can infer Alice's first bit using just two ingredients: the 
result of the public measurement, and the result of his 
(her) own secret measurement. Therefore, once Bob 
(Carol) knows the result of the public measurement, he 
(she) can infer the first bit of the result of Alice's secret 
measurement. The process can be sequentially repeated. 



IV. QUANTUM SECRET SHARING OF 
CLASSICAL INFORMATION 



A. Hillery-Buzek-Berthiaume secret sharing using 
GHZ states 



Consider the following problem: Alice wishes to con- 
vey a key to Bob and Carol in such a way that none 
of them can read it on their own, only if they collabo- 
rate. In addition, they wish to prevent that Eve acquires 
information without being detected. This is an interest- 
ing problem in the following scenario ^^ : Alice wants to 
have a secret action taken on her behalf in a distant part. 
There she has two agents. Bob and Carol, who carry it 
out for her. Alice knows that one and only one of them is 
dishonest, but she does not know which one. She cannot 
simply send a secure message to both of them, because 
the dishonest one will try to sabotage the action, but she 
knows that if both carry it out together, the honest one 
will keep the dishonest one from doing any damage. 

A first solution to this problem using quantum tools 
was provided in Ref . [EOl , and can be summarized as fol- 
lows: Alice prepares three qubits in the GHZ state given 



by Eq. (|12|), and sends one qubit out to Bob, another 
to Carol, and keeps the third. Bob and Carol indepen- 
dently and randomly choose whether to measure ax or 
ay on their qubits. They then publicly announce which 
measurement they have made, but not which result they 
have obtained. If Bob and Carol have chosen the same 
measurement, they can then determine what was the re- 
sult of Alice's measurement by combining their results. 
This allows Alice, Bob, and Carol to establish a common 
key. The other events in which Bob and Carol have cho- 
sen different measurements (which are ^ of the events) 
do not allow them to make useful inferences to estab- 
lish a key and are therefore rejected. For details on this 
protocol and for proofs of its security see PQ,pi| • 



B. Karlsson-Koashi-Imoto secret sharing using Bell 
states 

In Ref. [|l| another protocol for secret sharing using 
Bell states instead of GHZ states is proposed. It works as 
follows: Alice prepares two qubits in one of the following 
four states: 
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and sends out one of the qubits to Bob and the other 
to Carol. They independently and randomly perform a 
measurement of either az or a^- Then Bob and Carol 
have a public discussion where they declare the mea- 
surement outcomes for a subset of bits used for testing 
eavesdropping. It is essential that this discussion takes 
place before any further declaration. If they do not de- 
tect eavesdropping, Bob publicly declares the outcomes 
of his measurements (but not yet his choice of measure- 
ments) , then Carol declares both her choice of measure- 
ments and the corresponding outcomes, and finally Bob 
declares his choice of measurements (the order of the dec- 
larations is important to preserve security). Then, Al- 
ice publicly reveals whether she has prepared one of the 
states {IV'"'") , \(t)~)}, or one of the states {|*"^) , |*")} 



(but not which specific state she has prepared). If Ahce 
has prepared a state of the first (second) set, then the 
results of Bob's and Carol's local measurements are cor- 
related only if both have chosen to measure a^ or both 
have chosen to measure a^ (if one of them has chosen 
to measure a^ and the other has chosen to measure a^)- 
Such correlations allow Bob and Carol to find out which 
state Alice has prepared. But this is only possible if both 
cooperate. Note that in this protocol, in half of the events 
there is no correlation between Bob's and Carol's results 
so half of the events are not useful for secret sharing and 
must be rejected. 



C. Secret sharing using entanglement swapping 
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In Sec. IIIB we saw how to distribute one bit between 



three users employing ES between two-qubit Bell states 
and three-qubit GHZ states. In this section we show that 
the scenario described there also allows secret sharing of 
classical information. The protocol for secret sharing has 
steps (i) to (iii) in common with the protocol of multi- 
party key distribution described in Sec. [II B. In step 



(iv), we saw that once Bob (Carol) knows the result of 
the public measurement, he (she) can infer the first bit 
of the result of Alice's secret measurement. In addition, 
as a close inspection of Table II shows, once Bob (Carol) 
knows the result of Carol's (Bob's) secret measurement, 
he (she) can infer the second bit of the result of Alice's 
secret measurement. That is, if Bob and Carol cooper- 
ate they can infer this second bit. Therefore, the same 
scenario allows us to develop a protocol for multiparty 
key distribution and, simultaneously, a protocol for se- 
cret sharing. 



V. ES-BASED PROTOCOL FOR MULTIPARTY 

KEY DISTRIBUTION AND SECRET SHARING 

BETWEEN MORE THAN THREE USERS 

Both the scheme for multip arty key distribution based 
on ES, described in Sec. IIIB, and the scheme for secret 



sharing described in Sec. IVC, can be extended to N 
users as follows: 

(i) Every user has a pair of qubits in a public Bell 
state. In addition, Alice has another N qubits prepared 
in a GHZ state of the orthonormal basis: 
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For instance, consider that the initial state of the system 
is 
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(ii) Then, Alice sends a qubit of her GHZ state out to 
each of the other A^ — 1 users. Next, each user (including 
Alice) performs a Bell-state measurement on the received 
qubit and one of their qubits. 

(iii) After these measurements the state of the system 
becomes 



1^,,,) = \AP) (g) \AS) (g) \BS) (g) ... ® \NS) 



(35) 

where \AP) is a A^-qubit GHZ state of the basis (|^- 
( p3| ) , and the ordering of the qubits is not the same as in 
1^^ (as occurs in Sees. II A and III B). 

(iv) Then, the A — 1 users sends a qubit (the one they 
have no used) to Alice, and she performs a measurement 
to discriminate between the 2^ GHZ states (|3(]|)-(p3|), 
and publicly announces the result. This result AP, and 
the result of their own secret measurement allow each 
legitimate user to infer the first bit of Alice's secret result 
AS. To find out the second bit of AS, all users (except 
Alice) must cooperate. For instance, in case there are 
four users (Alice, Bob, Carol, and David), to obtain the 
second bit of AS it is not enough that Bob and Carol 
share their secret results. As Table III shows, they also 
need to know David's secret result. 



VI. SECURITY OF THE PROTOCOLS BASED 
ON MULTIPARTICLE ES 

The proof of the security against eavesdropping of the 
protocols for multiparty key distribution and secret shar- 
ing based on multiparticle ES is parallel to the one de- 
veloped in Sec. 11 B for the protocol for two parties key 
distribution. The guidelines of the proof arc the follow- 
ing: 

AS (whose first bit defines the part of the key that 
the legitimate users can obtain without cooperating, and 
whose second bit defines the part of the key that the users 
can obtain if they cooperate) is a random number, and 
Eve cannot do anything to change or influence it. 

In order to obtain the first (second) bit of AS, Eve 
needs the same ingredients that any legitimate user 
needs: the result of the secret measurement of one (all) 
of them, and AP. 

Any attempt to find out one of the secret results will 
change the result AP in an unpredictable way. There- 
fore, Eve's presence can be detected. Indeed, detecting 
Eve requires the comparison of fewer bits than in other 
protocols since the probability that the result AP is a 
being N the number of users. 



wrong one is — jiy- 



VII. CONCLUSIONS 

The main aim of this paper has been to introduce new 
protocols for multiparty key distribution and secret shar- 
ing of classical information. The main interest of the 
protocols based on ES is that they provide a conceptu- 
ally different way to solve certain problems of informa- 
tion theory. Its main advantages are that no transmitted 
quantum data are rejected, so they improve the efficiency 
of previous protocols; and that the detection of Eve re- 
quires the comparison of fewer bits, since the probability 
that Eve alters the result expected by the legitimate users 
is higher. On the other hand, since these protocols in- 
volve complete Bell-state and GHZ-state discriminations, 
they are much more difficult to perform in practice than 
previous protocols based on simpler measurements. 

In this paper we have focused our attention in the dis- 
tribution of classical information. However, as occurs 
with previous proposals, the protocols presented here can 
also be used, with little modifications, to distribute quan- 
tum information 



20 1 and for secret sharing of quantum 



information 
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TABLE I. The 16 possible combinations of results of Alice's 
public Bell-state measurement, and Alice's and Bob's secret 
Bell-state measurements on the initial state given by Eq. Alv. 
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Public Alice Bob Carol David 
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TABLE in. The 16 possible combinations of results of Al- 
ice's, Bob's, Carol's, and David's secret Bell-state measure- 
ments on the initial state |0000) ® 1 00> (g) 1 00) (g) 1 00) ® 1 00) , if the 
result of Alice's public four-qubit GHZ-state measurement is 
"0000". 



TABLE II. The 64 possible combinations of results of Alice's 
public GHZ-state measurement, Alice's, Bob's, and Carol's 
secret Bell-state measurements on the initial state given by 
Eq. (R. 
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FIG. 1: (al) and (a2) represent two steps of the protocol for 
two-party key distribution based on ES, assuming that Eve 
wants to obtain the result of Bob's secret measurement, (al) 
represents the situation before Alice's and Bob's secret mea- 
surements, and (a2) the situation after these measurements, 
(bl) and (b2) represent, respectively, the same two steps, (al) 
and (a2), but assuming that Eve is not present. Bold lines 
connect qubits in Bell states. 
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FIG.. 2: The four steps of the three-party key distribution 
protocol based on ES. The notation is the same introduced 
in Ref. pi: triangles connect qubits in GHZ states, bold lines 
connect qubits in Bell states, and dashed lines represent Bell- 
state measurements. 



